Firefox 3.6 locks down component directory

By Ci7
in Back Page News

 Share

Recommended Posts

Grand Master

Ci7

Posted
Posted
The Mozilla developers have announced that Firefox 3.6 will "lockdown" the components directory of the browser to stop third party applications bypassing the standard add-ons and plug-in support by pushing user invisible changes directly into Firefox. From today's planned release of Firefox 3.6's beta 3, and onwards, the components directory will be for Firefox code only and third party developers will only be able to extend the browser through the officially supported add-ons system.

Johnathan Nightingale, "Human Shield" at Mozilla, announced the change in a blog posting where he explained that the change in policy was driven by a need to increase the stability of Firefox. Extensions that are installed through the components directory, called "raw components", are not visible in the users Add-On Manager dialogue and do not carry version information with them. This means that neither Firefox or the user can detect out of date versions of these extensions, or update or disable them.

Nightingale directs add-on developers who use "raw components" to a document on the Mozilla Developer Center which covers the process of migrating "raw components" into add-ons.

source

Grand Master

zeroday

Posted
Posted

Wait a sec, people can install extras that don't show up on the add-ons list and bypass the confirmation UI? Am I the only one wondering why it's taken them until 3.6 to fix this? Didn't they think for a second this might be a security problem and lets put that confirmation UI to some use? :rolleyes:

Grand Master

primexx

Posted
Posted
About time, this will prevent stuff like that MS addon that installed without the user knowing

that one was actually a proper addon, just installed without prompt.

i get the feeling that this is talking about the invisible stuff like the java console for example.

Grand Master

Rudy

Posted
Posted
that one was actually a proper addon, just installed without prompt.

i get the feeling that this is talking about the invisible stuff like the java console for example.

im not saying it wasn't a "proper" addon, but it should have never been installed without a prompt. This should hopefully fix this issue

Veteran

Lord Ba'al

Posted
Posted
Wait a sec, people can install extras that don't show up on the add-ons list and bypass the confirmation UI? Am I the only one wondering why it's taken them until 3.6 to fix this? Didn't they think for a second this might be a security problem and lets put that confirmation UI to some use? :rolleyes:

At least they thought about it now. Better late than never.

Apprentice

Zetaprime

Posted
Posted
At least they thought about it now. Better late than never.

I don't like this new lockout 'feature'. When 3.6 beta 3 installed it disabled many of my extensions. I'd like to be the one to decide how stable I need Firefox to be and which extensions I want to use. I don't want this security crap forced down my throat Windows Vista style. I had to reinstall beta 2 to get my extensions back. Now I guess I won't be updating Firefox anymore.

Veteran

toadeater

Posted
Posted
I don't like this new lockout 'feature'. When 3.6 beta 3 installed it disabled many of my extensions. I'd like to be the one to decide how stable I need Firefox to be and which extensions I want to use. I don't want this security crap forced down my throat Windows Vista style. I had to reinstall beta 2 to get my extensions back. Now I guess I won't be updating Firefox anymore.

It has always done that. You mean Nightly Tester Tools won't re-enable them anymore?

https://addons.mozilla.org/en-US/firefox/addon/6543

Grand Master

hdood

Posted
Posted
I don't like this new lockout 'feature'. When 3.6 beta 3 installed it disabled many of my extensions. I'd like to be the one to decide how stable I need Firefox to be and which extensions I want to use. I don't want this security crap forced down my throat Windows Vista style. I had to reinstall beta 2 to get my extensions back. Now I guess I won't be updating Firefox anymore.

Like other people have pointed out, that is a compatibility issue and completely unrelated to this new feature that is intended to stop other software from silently slipping extensions and plugins into your Firefox and potentially compromising it. You have to accept these compatibility issues when running a pre-release version of Firefox. If you don't want to have to deal with this, simply avoid pre-release versions that clearly are not intended for you, and wait for the final release to come out and the extension authors to verify the compatibility. You don't have to have the absolutely latest pre-release build.

Also, it would have taken you mere seconds to find out that you can easily disable the compatibility check in b3 by simply going into the settings and setting the boolean extensions.checkCompatibility.3.6b to false. In fact, this is discussed in the beta 3 thread just a few lines below this one in the forum index.

Apprentice

Zetaprime

Posted
Posted
Like other people have pointed out, that is a compatibility issue and completely unrelated to this new feature that is intended to stop other software from silently slipping extensions and plugins into your Firefox and potentially compromising it. You have to accept these compatibility issues when running a pre-release version of Firefox. If you don't want to have to deal with this, simply avoid pre-release versions that clearly are not intended for you, and wait for the final release to come out and the extension authors to verify the compatibility. You don't have to have the absolutely latest pre-release build.

Also, it would have taken you mere seconds to find out that you can easily disable the compatibility check in b3 by simply going into the settings and setting the boolean extensions.checkCompatibility.3.6b to false. In fact, this is discussed in the beta 3 thread just a few lines below this one in the forum index.

Actually, this is only going from beta 2 to beta 3. You would have me believe that suddenly all the stuff that worked with beta 2 is incompatible with beta 3? I don't buy it. And instead of being condescending you might want to try being nice. As a matter of fact I have set extensions.checkCompatibility to False. I've been using it that way for a long time..and I also have nightly tester tools installed, and it has worked up till now. So I think it's the new component directory lockdown feature and not mere compatibility issues.

Apprentice

Zetaprime

Posted
Posted

I found a solution to my add-ons not working in beta 3...Add-on Compatibility Reporter located at:

https://addons.mozilla.org/nl/firefox/addon/15003

Installing that took care of the addons that even Nightly Tester Tools wouldn't allow me to use. I hope this is useful to anyone else having the same problem I had.

Grand Master

The_Decryptor Veteran

Posted
  • Veteran
Posted
...

As a matter of fact I have set extensions.checkCompatibility to False.

...

extensions.checkCompatibility has been renamed with beta 3, now it's extensions.checkCompatibility.3.6b (it needs to be kept in sync with the version you want to make it compatibile with, since otherwise people will leave it enabled, forgetting about it and running into crashes and bugs when they upgrade.

Grand Master

hdood

Posted
Posted
Actually, this is only going from beta 2 to beta 3. You would have me believe that suddenly all the stuff that worked with beta 2 is incompatible with beta 3? I don't buy it. And instead of being condescending you might want to try being nice. As a matter of fact I have set extensions.checkCompatibility to False. I've been using it that way for a long time..and I also have nightly tester tools installed, and it has worked up till now. So I think it's the new component directory lockdown feature and not mere compatibility issues.

Except that is not the option I said you should set. I said, as The_Decryptor points out, extensions.checkCompatibility.3.6b. He also explains the reasoning behind the change, which you could also have found if you had spent a minimum of effort looking it up (as one might be expected to do with seemingly weird changes in pre-release software) instead of going on a rant against a new feature that is actually important and completely unrelated and proclaiming that you're never going to use Firefox in the future.

Veteran

Boeing 787

Posted
Posted

This is good news, any addon should use the front door and not try and slip in the backdoor.

BTW: This version disabled 4 of my addons which where easily forced to be enabled with Mr Tech Toolkit: https://addons.mozilla.org/en-US/firefox/addon/421

Experienced

mancode20

Posted
Posted
extensions.checkCompatibility has been renamed with beta 3, now it's extensions.checkCompatibility.3.6b (it needs to be kept in sync with the version you want to make it compatibile with, since otherwise people will leave it enabled, forgetting about it and running into crashes and bugs when they upgrade.
I've upgraded to 3.6 Beta 3, yet in about:config mine still says extensions.checkCompatibility. What's up with that? Isn't it supposed to have the 3.6b on it now? Also, do we not need Nightly Tester Tools to force the install of incompatible extensions as long as we have it to set to false? So there would be no use for that extension as well as the Add-On Compatibility Reporter, right? Trying to cut back on extensions. It would be nice to remove those if possible.
Grand Master

The_Decryptor Veteran

Posted
  • Veteran
Posted

You have to create the preference (same way you had to create the old version), it's not there by default.

Edit: Yes, if it's set to false any extension will automatically install, but you'll run into issues eventually (like Greasemokey, last I checked it doesn't work in current builds of 3.7)

Experienced

mancode20

Posted
Posted
I found a solution to my add-ons not working in beta 3...Add-on Compatibility Reporter located at:

https://addons.mozilla.org/nl/firefox/addon/15003

Installing that took care of the addons that even Nightly Tester Tools wouldn't allow me to use. I hope this is useful to anyone else having the same problem I had.

If this is true, should I just uninstall Nightly Tester Tools and just use Add-On Compatibility Reporter? There's no need for both, right? I heard they conflict with each other.
Experienced

mancode20

Posted
Posted
You have to create the preference (same way you had to create the old version), it's not there by default.

Edit: Yes, if it's set to false any extension will automatically install, but you'll run into issues eventually (like Greasemokey, last I checked it doesn't work in current builds of 3.7)

Thanks. I didn't know that. So is there a way to erase the old one, or do I just create a new one?
Apprentice

Zetaprime

Posted
Posted
Except that is not the option I said you should set. I said, as The_Decryptor points out, extensions.checkCompatibility.3.6b. He also explains the reasoning behind the change, which you could also have found if you had spent a minimum of effort looking it up (as one might be expected to do with seemingly weird changes in pre-release software) instead of going on a rant against a new feature that is actually important and completely unrelated and proclaiming that you're never going to use Firefox in the future.

You call that a rant? Evidently you've never seen a real rant if you think that was one. I think I'll just add you to my ignore list since you are none too friendly.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.